# -*- coding:utf-8 -*-

# ======= import =======

import idautils
import idaapi
import idc
import ida_funcs
import re

file_path = "d:\\output_protobuf.txt"

def is_sub_name_format(name):
    pattern = r"sub_[0-9a-fA-F]+"
    return re.match(pattern, name) is not None

def check_starts_with_SEH(input_string):
    return input_string.startswith("SEH")
    
def check_starts_with_NULL(input_string):
    return input_string.startswith("null")
   
def check_starts_with_UNK(input_string):
    return input_string.startswith("unknown")

def check_question_mark(input_string):
    return "?" in input_string
    
def check_question_mark2(input_string):
    return "@" in input_string
    
def check_unknown_mark(input_string):
    return "unknown" in input_string
    
def check_not_sdk_name(input_string):
    return not check_starts_with_SEH(input_string) and not check_starts_with_NULL(input_string) and not check_starts_with_UNK(input_string) and not check_unknown_mark(input_string)
    
def get_modified_function_names():

    with open(file_path, "w") as file:
    
        # 遍历所有函数
        for function_ea in idautils.Functions():
            original_name = ida_funcs.get_func_name(function_ea)
            #current_name = idc.GetFunctionName(function_ea)
            #funname=ida_name.get_name(function_ea)
            
            #print("addr:0x%x\t original_name:%s\n", hex(function_ea), original_name)
            #print("addr:0x%x\t current_name:%s\n", hex(function_ea), current_name)
            #print("addr:0x%x\t funname:%s\n", hex(function_ea), funname)
            #print("current_name:%s\n",current_name)
    		
            if not is_sub_name_format(original_name):
                if check_not_sdk_name(original_name):
                    comment = idc.GetFunctionCmt(function_ea,1);
                    file.write( hex(function_ea) + "  " +  original_name + "  " +  comment + "\n" )
                    comment = ""
                    # file.write( function_ea + "  " +  original_name + "\n" )
    
    return 

# 获取所有用户修改过的函数名和对应地址
get_modified_function_names()
print ("over")